﻿//------------------------------------------------------------------------------
//  此代码版权声明为全文件覆盖，如有原作者特别声明，会在下方手动补充
//  此代码版权（除特别声明外的代码）归作者本人Diego所有
//  源代码使用协议遵循本仓库的开源协议及附加协议
//  Gitee源代码仓库：https://gitee.com/diego2098/ThingsGateway
//  Github源代码仓库：https://github.com/kimdiego2098/ThingsGateway
//  使用文档：https://thingsgateway.cn/
//  QQ群：605534569
//------------------------------------------------------------------------------

using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Mvc;

namespace ThingsGateway.Admin.Application;

/// <summary>
/// 文件下载
/// </summary>
[ApiDescriptionSettings(false)]
[Route("api/file")]
public class FileController : ControllerBase
{
    /// <summary>
    /// 下载wwwroot文件夹下的文件
    /// </summary>
    /// <param name="fileName">相对路径</param>
    /// <returns></returns>
    [HttpGet("download")]
    public IActionResult Download(string fileName)
    {
        // Validate the fileName to prevent path injection
        if (string.IsNullOrEmpty(fileName))
        {
            return BadRequest("Invalid file name.");
        }

        var root = Directory.GetCurrentDirectory();
        var wwwroot = Path.Combine(root, "wwwroot");
        var filePath = Path.Combine(wwwroot, fileName);
#pragma warning disable CA3003
        if ((!(fileName.StartsWith(@"../Logs") || fileName.StartsWith(@"..\Logs")) && filePath.Contains("..")) || !System.IO.File.Exists(filePath))
        {
            return NotFound();
        }
#pragma warning restore CA3003

        var fileStream = new FileStream(filePath, FileMode.Open, FileAccess.Read, FileShare.ReadWrite);

        Response.Headers.Append("Access-Control-Expose-Headers", "Content-Disposition");

        return File(fileStream, "application/octet-stream", (Path.GetFileName(filePath).Replace('/', '_')));
    }
}
